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Abstract 

NASA Goddard Space Flight Center is 
developing a class of satellites called nano- 
satellites. The technologies developed for 
these satellites will enable a class of 
constellation missions for the NASA Space 
Science Sun-Earth Connections theme and will 
be of great benefit to other NASA enterprises. 

A major challenge for these missions is 
meeting significant scientific objectives with 
limited onboard and ground-based resources. 
Total spacecraft power is limited by the small 
satellite size. Additionally, it is highly 
desirable to minimize operational costs by 
limi ting the ground support required to manage 
the constellation. 

This paper will describe how these challenges 
are met in the design of the nanosat power 
system. We will address the factors 
considered and tradeoffs made in deriving the 
nanosat power system architecture. We will 
discuss how incorporating onboard fault 
detection and correction capability yields a 
robust spacecraft power bus without the mass 
and volume penalties incurred from redundant 
systems and describe how power system 
efficiency is maximized throughout the 
mission duration. 

1. Nanosat Overview 

The primary objective of the GSFC 
Nanosat development effort is to enable flying 
tens to hundreds of nano-satellites in a 


constellation to make multiple remote and 
in-situ measure-ments in space [1]. This will 
revolutionize the scientific investigations of 
key physical processes explored by the Space 
Science and Earth Science communities. To 
enable this goal, we must develop advanced 
technology that is low cost, lightweight, low 
power and survivable in a space radiation 
environment over a two year mission lifetime. 

The next generation of Space Science missions 
requires the deployment of multiple spatially 
separated sensors to answer fundamental 
questions that arise in NASA’s Sun-Earth 
Connections (SEC) theme [2]. Magneto- 
spheric Constellation (MAGCON), a keystone 
mission on the SEC Roadmap, is to obtain the 
first dynamic overview of Space Weather. To 
implement MAGCON numerous weather 
stations (tens to hundreds of spacecraft) must 
be placed in orbit about the Sun and the Earth. 
Thus this constellation of spacecraft must be 
simple and economical to build, orbit, and 
operate. The spacecraft must withstand 
demanding physical conditions and long 
communication blackouts, while meeting 
demanding data return requirements. As 
Earth, Planetary, and Deep Space missions 
share similar concerns, the enabling 
technologies we are developing apply. These 
demands are driving spacecraft technology 
toward smaller, constrained spacecraft: 
Nanosats. 

Nanosats will be small, efficient, and capable 



spacecraft that enable missions requiring 
multiple independent instrument platforms. 
Smaller, however, does not necessarily mean 
less capable, but it does require a highly 
integrated system with intelligent control 
strategies. Resources to support redundancy 
are not available. In this paper, we focus on 
the Electronic Power System of the Spacecraft. 
We will discuss how integrating the power 
system with other subsystems enables more 
capable spacecraft. In addition, we will 
discuss how the PSE architecture and 
advanced autonomous control strategies 
eliminate string redundancy and enhance 
spacecraft reliability and reduce ground 
support costs. 

To enhance reliability and eliminate string 
redundancy, we turn to robust, autonomously 
adaptive systems. Care is being taken to 
implement solely within the local power 
subsystem only those tasks absolutely 
necessary for immediate health and safety. 
Other tasks that may be required only 
periodically will be implemented remotely on 
the spacecraft CPU. The spacecraft will 
operate as a 'single string' system since 
redundant hardware or software is not 
implemented. 

1.1 Spacecraft Redundancy 

Nanosats are not large enough to 
support the traditional concept of component 
redundancy to implement fault tolerance. 

Indeed, Nanosats are so restrictive that many 
spacecraft systems must be developed in an 
integrated way to symbiotically satisfy 
multiple needs, e.g. structural, thermal, and 
power. Individual components provide 
multiple functionality, so Nanosat operates as 
a single-string system, where the failure of one 
function may stop the system. Fault tolerance 
and availability of operation are obtained with 
Nanosat through multiple spacecraft, but as in 
the game of chess, one should not waste one’s 
pieces. The spacecraft must be made as robust 
as possible, and care must be taken to ensure 
that systematic problems do not arise among 
the elements of the Nanosat Constellations. In 
this way, though individual Nanosats may 


degrade and fail, the capability of the Nanosat 
Constellation will more gracefully decay. 

2. Challenges and Constraints 

The MAGCON mission samples a large 
fraction of the Earth’s magnetosphere. Many 
MAGCON Nanosats will have orbital periods 
of ten or more days. With their low power 
and small antennae, Nanosats will only be able 
communicate with the ground for the few 
hours when the spacecraft is near perigee. 

The ten day communication blackouts lend an 
extreme Deep Space character to Space 
Science Nanosat missions. To put this aspect 
of Nanosat requirements in perspective, the 
round trip light travel time between Earth and 
Pluto is between 8 and 14 hours. The 
operators of a mission to Pluto would likely 
learn of and respond to problems with their 
spacecraft more rapidly than would operators 
of MAGCON Nanosats. To be fair, these 
Nanosats will have much better 
communication rates to ground at perigee than 
a spacecraft at Pluto. But MAGCON Nanosats 
will have to take more responsibility for their 
own function than previous solar terrestrial 
probes [3]. 

3. Traditional Power System Control 

Traditional spacecraft design has 
focused on providing redundant equipment and 
configurations in order to provide effective 
mission support in spite of equipment failures 
and system degradation. In order to utilize 
these capabilities, a large number of telemetry 
points, or system data parameters, are provided 
to assist ground controllers, and in some 
instances, flight processors, in determining 
when and if failures occur. It should be noted 
that ground control plays a major role in this 
process. Except for a limited number of 
exceptions, system monitoring, anomaly 
detection and workarounds are performed by 
ground control. That is, all these functions are 
manual in nature. Though more autonomous 
operating procedures are being implemented 
for some newer, larger spacecraft, in the large 
majority of cases, if people don’t see or do it, 
no action will be taken. 



Two distinct groups of people make up the 
staff of a ground control center. Flight 
operations personnel are the people who 
routinely monitor the spacecraft during the 
periodic communications periods, called 
"passes". Depending on the kind of support 
being received, passes can be as short as ten to 
fifteen minutes in duration. During this time, 
real-time data must be analyzed, recorded 
playback data recovered, computer memory 
loaded, and spacecraft systems monitored for 
anomalies. Obviously, this leaves little time 
for any workaround activity other than the 
most fundamental, predefined anomaly 
reaction procedures. 

This is where the engineering staff participates 
in the effort. If anomalies occur during off 
hours (most seem to) the flight operations 
team contacts the on duty engineer. During 
working hours they may be in the control 
center itself. Real time and playback 
telemetry is reviewed, the anomaly identified 
and reaction plans developed. This can take 
hours or even days for severe problems. Most 
systems have "safe modes" that can be 
automatically triggered in severe problems 
occur, but these typically only put the 
spacecraft into safe configurations. They do 
nothing to address the anomaly, but almost 
always seriously affect mission effectiveness. 
Also, some safe modes require a great deal of 
effort to recover from. 

Finally a reaction plan is developed and 
command sequences prepared. They are then 
executed when communications with the 
spacecraft are next established. Simple 
sequences can be done in one pass, more 
complex procedures can take extended periods 
of time. A spacecraft with a large amount of 
redundant hardware and a complex set of 
possible configurations provides a range of 
responses, but also increases the amount of 
time necessary to prepare anomaly responses. 
It should be obvious that the traditional 
method of spacecraft control can be 
demanding and time consuming. 

Furthermore, MAGCON/Nanosat is not just 


one spacecraft. Indeed, it will be operated as a 
constellation of dozens to a hundred or more 
spacecraft. The spacecraft assessment and 
command generation for one-hundred 
individual idiosyncratic spacecraft is an 
incredibly challenging task. 

4. Why autonomy? 

The Electrical Power System (EPS) 
requires a degree of autonomy for solar array 
regulation, selection of battery charge rates, 
bus voltage regulation, load predictions, power 
availability, load shedding, circuit protection, 
optimization of the power system and 
reliability management of EPS cognizant areas. 

Constellation missions involving as many as a 
hundred spacecraft are a primary application of 
Nanosats. With so many Nanosats in a 
mission, it would be difficult to handle these 
by collecting the data, coding it, sending it to 
the ground, interpreting it, getting a human to 
look at it, make a decision, code the 
command, send it to the spacecraft, and insure 
the command was executed. This typical 
chain of events also requires more subsystem 
resources for Command and Data Handling 
(C&DH) and Communications (COM). And 
thus more power from the EPS. There is a 
great benefit for the EPS and for the rest of 
the spacecraft for as great a degree of 
autonomy as possible on the Nanosats. 

Ordinarily this degree of autonomy would 
require more processing power, however many 
EPS autonomy functions will be implemented 
locally independent of the Nanosat CPU. 

4.1 Single-string Reliability through 
Component Adaptability 

Having multiple spacecraft in similar 
orbits provides a basic measure of fault 
tolerance and availability, but spacecraft 
redundancy does not ensure spacecraft- 
effectiveness. In fact, this sort of redundancy 
carries its own risks: two eggs dropped on the 
floor break about as quickly as one and leave 
behind a bigger mess. 

The spacecraft must be made as robust as 



possible, and care must be taken to ensure that 
systematic problems do not arise among the 
elements of the Nanosat Constellations. In 
this way, though individual Nanosats may 
degrade and fail, the capability of the Nanosat 
Constellation will even more gracefully decay. 

To enhance reliability while eliminating string 
redundancy, we turn to robust, autonomously 
adaptive systems. Only those tasks absolutely 
necessary for short term (instantaneous) 
functionality are implemented within the local 
EPS. Less frequently executed tasks will 
share the spacecraft CPU with other 
subsystems. The spacecraft, particularly the 
hardware component, will operate as a 'single 
string’ system. 

An example is the EOS- AM battery design 
where two batteries are provided: either single 
battery would not be able to provide the 
mission requirement. Cell redundancy is 
incorporated into the design with cell by-pass 
circuitry to eliminate any cell that goes 
open-circuit. The bi-directional 
charger/discharger called the BPC will 
automatically sense the reduction of a cell and 
compensate for the battery operation. Thus, 
instead of having redundant strings, we place 
redundant elements within a string. EOS-PM 
and MAP battery designs rely even more on 
cell redundancy, the second battery is 
eliminated, leaving these systems with a single 
battery. 

A similar opportunity exists with solar arrays. 
The Nanosat solar array, like most solar arrays 
is made up of many solar cells in a series 
string, with many strings in parallel making up 
the system voltage and power requirement. 

The proportion of the load that any one solar 
string is supplying power to can be adjusted to 
provide system performance with redundancy. 
When the performance of a string degrades, 
the electronics will adjust the voltage output so 
the string still contributes power, though at a 
lower level. Thus, Nanosat operates as a 
single-string system, where the failures are 
tolerated by system self-adjustment. 


4.2 Component Adaptability and Multi-use 

We see that within the EPS subsystem 
there are opportunities for redundancy. Clever 
use of interdependence and parallelism enables 
adaptability as mentioned above. It also 
enables economical applications of resources. 
For example we are exploring a structural 
battery that will incorporate a mounting 
surface for the solar cells and will be a 
spacecraft support structure. We are even 
exploring housing our power electronics within 
the structure. In a sense, we are adapting 
power system components to meet EPS and 
spacecraft needs in novel ways. This 
integrated approach requires coordination 
among subsystem designers, but Nanosat 
demands the reduction in overhead resource 
costs. 

5. Intelligence and Autonomy 

In the context of robust and adaptive 
subsystem infrastructures, a symbiotic 
relationship between hardware-based and 
software-based logic could make possible the 
realization of the high level of autonomy 
desired for Nanosat in spite of its limited 
processing resources. One promising model of 
Nanosat autonomy is that realized by such a 
shared responsibility between subsystem 
hardware and subsystem-related software in 
Nanosat’ s shared processor. 

For a subsystem, the hardware-based 
autonomy will readily support the handling of 
situations that require a quick simple reaction. 
However, those situations which require more 
deliberation before acting will be handled by 
the subsystem’s autonomy-related software 
stored in the shared processor (Figure 1). 


5.1 Activities 

There are three basic types of activities 
that will be supported by the autonomy-related 
software in the Nanosat shared processor. 
These are: Trending, Science management, and 
FDIR (Fault Detection, Isolation, and Repair). 

Trending activities deal with predictions. 

From continuous subsystem or instrument state 



information, a trending function could be 
exercised to establish the possibility of 
eventually entering an anomalous state. The 
system could then initiate corrective actions to 
avoid the anomalous situation. 

Science management activities are focused on 
the use of heuristics to assign degrees of 
interest to the science data available and only 
store high-interest data. 

FDIR activities come into play when an 
anomalous situation occurs in either a 
subsystem or experiment package. State 
information from the subsystem or experiment 
package is used to determine that an anomaly 
exists. The FDIR logic then isolates the fault, 
i.e. determines the fault’s location, and 
initiates a sequence of (usually) pre-stored 
actions to get the subsystem or experiment 
package back to a good state. 



Figure 1. Nanosat EPS control concept. 


5.2 Technologies 

There are several overlapping 
autonomy-related technologies that can support 
these activities. These are: 


Rule-based: 

Model-based: 

Neural nets: 
Fuzzy Logic: 

Heuristics: 


quick reaction; 
deliberative reasoning, 
planning for action; 
classification of faults; 
approximate reasoning 
deals with inexact data; 
rule-of-thumb reasoning. 


reasoning, and model-based reasoning are 
becoming commonplace. • 

The second phase of an experimental 
agent-based ground operations system LOGOS 
(Lights-Out Ground Operations System) is 
under development. It has already shown how 
a community of agents can successfully act as 
surrogate controllers in an autonomous ground 
system. 


The autonomy resource on Nanosat can make 
use of the appropriate technology based on the 
situation and the nature of the data and 
information that needs to be reasoned with. 

5.3 Current Applications 

The realization of ground-based and space- 
based autonomy already has a strong and 
vibrant history. Here are a few examples [4]. 

The ground systems for such missions as 
GRO, XTE, MAP, IMAGE, TRACE, and HST 
all include elements of autonomy to assist 
human operators and analysts in the execution 
of their tasks. Applications of technologies 
like expert systems, neural networks, fuzzy 


Space-based systems are also participating in 
the encroachment of autonomy on operations. 
Autonomous attitude control systems are a 
critical spacecraft technology in use today. 
Autonomous navigation and on-board 
maneuver planning are being realized. The 
application of fuzzy controller technology 
supports this focus. The Remote Agent 
project has resulted in an experimental use of 
agent technology on the DS1 spacecraft. 
Extensive use of model-based reasoning for 
health and safety functions and spacecraft 
activity planning support this activity. The 
adaptive scheduler work for Next Generation 
Space Telescope (NGST) will contribute to 
better science agenda management. 




A Platform to. Ev aluate Competi ng Approaches 


Nanosat is in a position to significantly profit 
from these autonomy successes. It will also 
contribute to optimizations of the 
autonomy-related technologies because of its 
resource constraints. 

These techniques are critical to achieve the 
goals of some Nanosat applications. But what 
are the more immediate applications of the 
techniques of this section to Nanosat EPS? 

5.4 Intelligence and EPS 

In this section we discuss how onboard 
intelligence enhances the autonomy and 
function of the EPS. By intelligence we 
broadly mean the ability to learn or under- 
stand: it is the ability of the EPS to make 
decisions or change its behavior in light of its 
history. One strategy to obtain this 
adaptability is to make that history as 
uneventful as possible. In Section 4 we 
described an approach to achieving a large 
measure of autonomy through judicious 
design. There is not much to go wrong in an 
EPS designed for simplicity, nor is there much 
to configure or monitor. Thus the EPS is 
designed to provide simple behaviors and 
controls. 

The simplest way to build independence of 
human control into the EPS is to design a 
predictably steady, no-maintenance, robust 
system that lasts long enough to get the job 
done. Many aspects of the health and safety 
of the EPS must be designed into the system, 
for example, the safe operation of spacecraft 
batteries. By using low- or no-maintenance 
battery technologies and circuit designs that 
avoid overcharging, the Nanosat EPS has 
fewer degrees of freedom that require control, 
and certain faults are avoided. Unlike 
traditional power systems, most degrees of 
freedom of the EPS are handled within the 
EPS subsystem itself. Or put another way, the 
system is being designed with a few degrees 
of freedom as possible. A simple rule base 
running on a shared processor or an embedded 
EPS microcontroller could control the 
remaining degrees of freedom. Thus EPS 



Figure 2 . The EPS is being designed so 
that different control schemes may be 
quantitatively compared and analyzed. 


would monitor its battery charge, prescribe a 
charging rate, and could be smart enough to 
compensate for battery or solar cell failures as 
described above. Nanosat EPS is being 
designed to evaluate competing technologies 
to implement these control functions (Figure 
3), Fuzzy Logic is one key technology we are 
evaluating. 

5.5 EPS Operation 

Much EPS intelligence and adaptability 
is designed into the system itself to maintain 
the health of EPS components. Therefore, we 
introduce the concept of a Spacecraft Agent 
(SA) that is responsible for those things the 
EPS and other subsystems cannot do for 
themselves. This concept is similar to the 
New Millenium Remote Agent (NMRA) 
architecture being tested on board NASA’s 
Deep Space One [5]. The NMRA uses a 
variety of advanced AI techniques to achieve 
mission goals, and onboard planning and 
scheduling is major cost for the NMRA. The 
NMRA makes extensive use of Model-Based- 
Reasoning to determine and predict spacecraft 
state and to instruct the formation of plans of 
action [6]. We do not foresee the Nanosat SA 




requiring the same degree of complexity that 
DSl requires, so we are focussing our efforts 
to design Nanosat subsystems with simplicity 
and autonomy as key features from the start. 

On the other hand, the rapid advance of 
computing capability may make approaches 
such as used in DS 1 more applicable, therefore 
we are considering the costs and benefits of 
such software agent based autonomy. 

The main point is that we can design 
spacecraft subsytems to be controlled by the 
SA. Nanosat development will create systems 
and subsystems that operate with as little 
external input as is reasonable: simply 
reinstating the traditional command and control 
capability outlined in Section 3 on board the 
spacecraft is not our aim. 

So if we have done our job in making a 
reasonably worry free EPS, what tasks are left 
over for the SA to handle? The key 
functionality that SA can add to EPS operation 
is the distribution of power to spacecraft 
subsystems. Decisions about power 
distribution are to be deliberately left outside 
the purview of the EPS. The EPS provides 
electrical power and information about its 
current state, e.g. its current store of energy 
and its power production rate. The S A will 
have a planning and scheduling capability 
where it maps out its actions based on its 
understanding of the electrical sources, loads, 
and mission policy. 

S A will contend with issues and conflicts that 
arise as it makes sure that Nanosat has enough 
power to meet mission critical objectives. The 
SA must ensure that there is enough power to 
keep memory alive through eclipses and that 
the spacecraft has the power to communicate 
with the ground at perigee. Science 
instruments and other subsystems, e.g. C&DH, 
COM, usually have a number of modes of 
operation that require different amounts of 
power; the SA will set the modes of operation 
based on mission policy. In general, EPS is 
designed to provide the maximum required 
power, in which case, SA power allocation 
becomes important when there is a spacecraft 


fault. However, we know that EPS's power 
output will degrade over the lifetime of the 
mission, therefore it makes sense to design 
spacecraft subsystems to be able to adapt to 
the decline of this resource. 

Hence, SA will allocate power, and, if 
possible, SA will optimize power use per 
mission policy, e.g., to maximize the amount 
of Science data returned to Earth. Making 
these and other run-time decisions is the main 
function of the SA; how these decisions are 
made depends on the complexity of mission 
policy and the available resources. 

5.6 EPS Maintenance 

As stated above, the EPS provides the 
S A with information that SA uses to make and 
act on decisions. Following trends, e.g. power 
balance over time, is one possibly useful long 
term activity for the SA. Temperatures, 
currents, voltages may also provide insight 
into how the EPS is functioning. But what 
can the SA do with this information? What 
control points does EPS provide to S A? If the 
EPS team is successful, the answers to these 
two questions are very little and very few. 
Battery reconditioning is a prime example of 
our approach. Charge cycling some kinds of 
batteries improves their performance, but 
criteria and decisions must be made about 
when and how to perform this reconditioning. 
The logic associated with these criteria, 
decisions, routines, plans, and schedules must, 
for Nanosat, exist onboard the spacecraft either 
within the EPS or the S A. As discussed in 
sections 2 and 3, open-loop command is not 
an option. By choosing a battery technology 
that does not require reconditioning, one 
reduces the costs of the overhead required to 
make the decision. However, EPS function 
has not necessarily been diminished by using 
an alternative battery technology, in fact 
subsystem and system performance has just 
been enhanced. 

A key goal of the Nanosat team is to identify 
such opportunities for efficiency and 
aggressively take advantage of them. We 
believe that this approach will enable the 



application of a greater range of 
autonomy-related technologies onboard 
spacecraft. By judicious design, we will free 
the resources necessary to use more expensive 
techniques where they are truly required. 
However, this requires communication, 
coordination, and collaboration between 
mission and system designers, i.e. between and 
amongst scientists and engineers. Designs and 
requirements must iterate back and forth 
between these diverse groups of people, so 
that the group as a whole understands the 
implications of their decisions. This is likely 
the most difficult challenge Nanosat faces. 
(Note that this is forced on us by the expense 
of putting things into space.) 

5.7 Spacecraft Agent Implementation 

How the SA is to be implemented has 
not been determined, because it is still quite 
early in the project. Subsection 5.2 above lists 
a number of technologies that could be used; 
each technology has its own advantages and 
disadvantages. The Nanosat EPS is being 
designed to make it easier to use a broader 
range of these technologies, so that we can use 
the tool that seems most applicable to the task 
at hand. Heuristics based in Fuzzy Logic are 
strong contenders for several aspects of the 
system because they are efficient, convenient, 
and have been successfully deployed in the 
past. 

5.8 RISC and Spacecraft System Design 

In a sense, our approach is analogous 
to that taken by the developers of RISC 
technology for microprocessors. Reduced 
Instruction Set Computers feature simplified 
memory access and other functional behaviors. 
The regularity and simplicity of instruction 
sets based on load-store processor architectures 
allow compilers to produce smaller, more 
efficient executable [7]. With Nanosat, we are 
pursuing simpler, more regular subsystems to 
ease the task of the Spacecraft Agent (SA). A 
compiler makes decisions about how a 
processor is to behave, just as the SA makes 
decisions about how the spacecraft is to 
behave. 


6. Conclusion 

The Goddard Nanosat PSE is being 
designed to meet the requirements of the 
Magnetospheric Constellation mission by novel 
means. Many of the challenges we face are 
common to all small, inexpensive spacecraft, 
thus our approach may benefit a range of 
applications. The EPS architecture enhances 
reliability and eliminates string redundancy. 
Low-bandwidth tasks are implemented at a 
local subsystem level. Other tasks will be 
implemented remotely, sharing the resources 
of the spacecraft CPU, and communicating as 
required with the local power electronics. 
Several control strategies are being analyzed to 
facilitate the autonomous operations imposed 
by the ten day period of the 60x3 RE orbit. 
Control strategies that are currently resource 
intensive will be enabled through the judicious 
design of spacecraft subsystems. The desired 
behaviors of the Nanosat EPS are simple, and 
the subsystem’s internal degrees of freedom 
need not be many, therefore its control scheme 
can be simple and complete. 

Finally, the PSE will be implemented as one 
of several components in a highly integrated 
spacecraft. This will facilitate optimizing the 
control strategy of all the spacecraft 
subsystems, thereby enhancing the reliability, 
robustness, and function of the spacecraft on 
orbit All Nanosat subsystems, EPS, C&DH, 
COM, Science, and so on, will also follow this 
strategy of behavior simplification, 
regularization, and closure. 
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